CyberRota Analysis
AI-GeneratedThe BlueALSA daemon is vulnerable to a division-by-zero error in its LC3plus sink decoder, which can be exploited by a Bluetooth-adjacent attacker to crash the service. By sending a specially crafted RTP media header with a zero frame count, the attacker can trigger a denial of service on systems with LC3plus support enabled. Organizations using BlueALSA for Bluetooth audio streaming should prioritize patching this vulnerability to prevent potential disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.